CVE-2024-57907

What it actually does

Uninitialized kernel stack memory from a local struct is copied to userspace through an IIO triggered buffer because only active channels are written while inactive channels retain prior stack contents.

Why it matters to the business

Low-probability leakage of kernel memory contents that could contain sensitive data such as pointers or credentials; the issue affects embedded Linux systems using Rockchip SARADC but carries minimal operational disruption given the narrow device scope and absence from known exploitation lists.

How an attack unfolds

An attacker with local access to the affected ADC device opens the triggered buffer interface, configures a subset of channels as active, triggers a capture, and reads the returned buffer; uninitialized bytes from inactive channels are included, disclosing prior stack data that may aid further kernel exploitation.

How to fix it

Update the Linux kernel to a version containing commit 85a9c98a5e0f22d911b00077d751e34fff1401aa or later; rebuild and deploy the rockchip_saradc driver after applying the zero-initialization change to the data struct before the iio_for_each_active_channel loop.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or a backport that zeros the data struct; exercise the triggered buffer with mixed active/inactive channel masks and verify that inactive positions contain only zero bytes.

Typical attack path

1. Obtain local shell or process execution on a system exposing the rockchip_saradc IIO device
2. Open the character device or sysfs trigger interface and select a partial channel mask
3. Arm the trigger and perform a buffer read
4. Inspect returned data for non-zero or unexpected values in positions corresponding to inactive channels
5. Use leaked kernel pointers or memory patterns to bypass mitigations or locate other structures

How to detect it

Search kernel or audit logs for unusual IIO buffer reads on rockchip_saradc devices; inspect userspace processes that open /dev/iio:device* or trigger buffers and correlate with memory disclosure patterns; no public exploit artifacts are known.

What your security team should do

• Prioritize kernel upgrades on any Rockchip-based embedded or industrial devices within the next maintenance window
• Review IIO buffer usage in custom drivers or user-space applications for similar uninitialized-memory patterns
• Add the fixed commit hash to internal kernel patch baselines and CI build verification
• Monitor upstream stable trees for additional related IIO fixes